fix(s2n-quic-transport): treat clean connection close as dc complete

dc/s2n-quic-dc/src/psk/io.rs

@@ -37,6 +37,9 @@ pub const DEFAULT_MTU: u16 = DEFAULT_BASE_MTU;
 pub const DEFAULT_PTO_JITTER_PERCENTAGE: u8 = 33;
 const DEFAULT_INITIAL_RTT: Duration = Duration::from_millis(1);
 const DC_QUIC_VERSION: u32 = 0;
+/// Application error code the client uses to close a connection whose dcQUIC handshake did not
+/// complete when `ConfirmComplete` failed or timed out.
+const DC_HANDSHAKE_INCOMPLETE_ERROR: u32 = 1;
 /// Number of threads used to make progress on the TLS handshake
 pub const DEFAULT_THREAD_COUNT: usize = 0;
 
@@ -534,10 +537,22 @@ impl HandshakeQueue {
                 }
                 Ok(Err(e)) => {
                     // ConfirmComplete::wait_ready failed. We should treat the handshake as failed.
+                    //
+                    // Explicitly close instead of letting `connection` drop, which would emit a
+                    // clean (no-error) CONNECTION_CLOSE. A clean close is the signal the server
+                    // uses to complete the dc handshake when the token ACK is lost; since the
+                    // handshake did not complete here, we must not send it. Any explicit close is
+                    // emitted as an application CONNECTION_CLOSE (`connection::Error::Application`),
+                    // which the server does not treat as completion. If the connection is already
+                    // closed this is a no-op.
+                    connection.close(DC_HANDSHAKE_INCOMPLETE_ERROR.into());
                     return Err(e);
                 }
                 Err(_elapsed) => {
                     // Handshake timeout occurred. We should treat the handshake as failed.
+                    //
+                    // Close with an explicit error. This is the same reason as the first error case.
+                    connection.close(DC_HANDSHAKE_INCOMPLETE_ERROR.into());
                     return Err(io::Error::new(
                         io::ErrorKind::TimedOut,
                         "ConfirmComplete handshake timeout",